Your company's security team tends to use managed services when possible. You need to build a dashboard to show the number of deny hits that occur against configured firewall rules without…

Question

Options

• AConfigure Firewall Rules Logging.
• BConfigure Firewall Rules Logging.
• CConfigure a firewall appliance from the Google Cloud Marketplace.
• DConfigure Packet Mirroring on the VPC. Apply a filter with an IP address list of the Denied

• A
  79% (22)
• B
  4% (1)
• C
  7% (2)
• D
  11% (3)

Explanation

Firewall Rules Logging (A) is the correct managed-service approach. When enabled on a firewall rule, GCP automatically generates log entries in Cloud Logging for each connection that matches the rule (including deny hits), without any additional infrastructure to manage. These logs can then be queried in Cloud Logging or used to build dashboards in Cloud Monitoring or Looker Studio with minimal operational overhead. Note that options A and B are textually identical in this question, which appears to be a formatting error - the intended correct answer is Firewall Rules Logging. A firewall appliance from the Marketplace (C) increases operational overhead significantly. Packet Mirroring (D) captures all network traffic for deep inspection, requires a collector destination, and is much higher overhead than simply enabling logging on specific deny rules.

No community discussion yet for this question.